Ports! Can't live with 'em can't live without 'em. But which ones, eh?

I have been guilty, on occasion,  of following advice from EE without paying too much attention. Particularly when it comes to ports. Can we establish some rule-of-thumb typical standards for SBS-2003? Which ports should ALWAYS be closed? Which ports should typically be open for a SBS-2003 server used as such:

A   2x NIC DC with exchange no VPN no FTP no remote web/email
B    2x NIC DC with exchange with remote web/email no VPN no FTP
C   2x NIC DC with exchange with remote web/email with VPN no FTP
D   is FTP ever a good idea on a SBS?
E should port 80 ever be open?

I realize there maybe no definitive
LVL 2
hgj1357Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Lee W, MVPTechnology and Business Process AdvisorCommented:
The simple answer:

ALL Ports should always be closed
ALL Ports required to provide services on the internet should be open

IF you have an appropriate plug and play router, SBS will open the necessary ports for you.

A) Port 25
B) Port 25, 443, possibly port 80
C) Port 25, 443, 1723, possibly port 80
D) FTP in general is not a good idea.  Passwords are transferred in clear text, the data is completely unencrypted.  If you need an FTP site, allow it to be for external downloads only - do not permit uploads and only allow anonymous access. FTP can be scripted EASILY and used as a method for obtaining passwords.
E) If you want to run a publicly accessibly web site, yes.  And I believe if you open it with RWW in use, it would forward you to an HTTPS site.  Keep in mind, while every port that is open is a place to attack, IIS 6 has been a very secure product in comparison to other products, even Apache.  IT's not bulletproof, but it's not an eggshell either.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
MarkMichaelCommented:
The only port I ever (grudgingly) open up is HTTPS (tcp/443) for secure OWA access. I prefer to do everything else via VPN.
0
hgj1357Author Commented:
I was hoping this would develop into a good discussion on ports.

i.e. different ports may be open one one NIC, and closed on the other.

Every port should be open on the routers. Or maybe not.

I understand if there is less enthusiasm there than there is here.
0
MarkMichaelCommented:
From a security perspective, open ports = bad; it's really that simple. It's not infeasible to think that someone, somewhere, someday will write an exploit that addresses a service you have open to the Internet.
All we can do to mitigate that threat is to have as few services open to the Internet as possible and make sure they are patched to the hilt :)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
SBS

From novice to tech pro — start learning today.